This vulnerability in Oracle Commerce Platform 11.4.0 allows an unauthenticated attacker with network access via HTTP to compromise the platform. Exploitation can lead to unauthorized access to all accessible data within the platform or cause a hang or repeatable crash resulting in a complete denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and availability impacts but no integrity impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the specific patch status for this vulnerability is not explicitly confirmed in the advisory content provided.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Commerce Platform 11.4.0 and can cause a denial of service through platform hang or repeated crashes. This impacts confidentiality and availability severely, but not integrity. There are no known exploits in the wild reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for CVE-2026-61130. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, consider restricting network access to the Oracle Commerce Platform HTTP interface to trusted sources only.